Plain-language policy, last updated August 2026. This page governs the website and the founding-cohort application form. A fuller policy covering customer financial-data intake will be published before that intake begins — more detailed than this one, not different in spirit.
There are no analytics scripts, no advertising tags, and no tracking cookies on this website. We don't build a profile of your visit.
Two things still happen that are worth naming. The site is hosted on Cloudflare Pages, and like any web host Cloudflare processes and logs the requests it serves — IP address, timestamp, requested URL, user agent — as part of delivering the site and protecting it from attack. Separately, page fonts load from Google Fonts, so your browser makes a request to Google's servers when a page opens. Neither is something we read for marketing, but both are real, and you shouldn't have to guess at them.
The application form collects more than a contact form does, so here is the complete list of what a submitted application stores.
What you type: your name, email address, and phone number if you give one; your business name, location count, city and state, and time in operation; your operating model, weekly sales range, and the systems you use for POS, payroll, accounting, inventory, and receipts; your answers about where you think money is leaking, what you handle personally, what breaks when you're away, and what you'd like to delegate; your readiness answers; and your four consent choices.
What the server records automatically: the time of submission; your browser's user-agent string; the country your request came from, as reported by Cloudflare; a hashed version of your IP address, used to rate-limit abuse and catch duplicate submissions — we do not store the address itself, and the hash cannot be turned back into one; and a referral source, meaning the site that linked you here or a campaign tag from the URL.
Ranges are encouraged over precise figures. We don't need documents, bank details, or account numbers to review an application, so please don't include them.
Application data is used only to review your application, contact you about it, and manage cohort capacity. Optional research and testimonial consents are separate checkboxes and change nothing about your review. We do not sell personal information, and we do not use application answers in marketing without separate written permission.
We use a small number of third-party services, and your application passes through them. Cloudflare hosts the site and runs the application endpoint, and provides the anti-bot check on the form (Cloudflare Turnstile), which verifies you're a person without tracking you across sites. Supabase hosts the database where applications are stored. Resend delivers the notification email telling us an application arrived — that notification includes your name, email, business type, location, sales range, and your description of the suspected leak — and will carry our reply to you. If we add or change a processor, this list changes with it.
The application form has no direct database access at all. Your browser holds no database credentials; it posts to an endpoint on this site, and only that server-side endpoint — running with credentials that never reach your browser — writes to the database. The database itself denies all access to anonymous and public signed-in roles, so even if every key present in this website were extracted, none of them would read, change, or list a single application.
Applications that are declined or withdrawn are deleted automatically 24 months after review. Applications from businesses that join the cohort are kept for the life of the engagement and then handled under the customer agreement. You can ask for deletion sooner at any point, including while your application is still under review, and we'll do it.
Email hello@trysofrito.com to ask what we hold about you, get a copy, correct it, or have it deleted. We'll confirm within five business days and complete the request within thirty. You don't need to give a reason, and asking will not affect how your application is reviewed.
Questions about this policy — or anything on it you think is wrong or incomplete: hello@trysofrito.com.